Required 2FA is only enforced on the next sign-in

The Require 2FA for all admins setting does not immediately make 2FA a condition of Workspace access. Existing teammates can keep using their active sessions without enrolling, and newly invited teammates can register, accept the invite, and enter the Workspace before enrollment is required.

When a Workspace requires 2FA, an unenrolled teammate should be sent to enrollment before Workspace access is granted, including immediately after invite acceptance. Enabling the setting should also prevent existing unenrolled sessions from continuing to access the Workspace indefinitely.